Will make this short and simple. We have an old VPN 3000 that we are replacing with ASA 5515X. We use EIGRP on our internal network. For VPN lan-to-lan traffic we force it out to the VPN 3000 using static routes. The Nexus 7k and VPN3000 have a locally connected network/router-interface/instance.
With new ASA 5515x we enabled EIGRP. The ASA 5515x and Nexus also are directly connected via another local/connected router interface/instance.
I want to be able to "float" tunnels over at the clients discretion to the new ASA5515. My plan to do this is to leverage weighted static route on the Nexus that points to the old VPN concentrator, and have the ASA use reverse-route-injection and redistribute static with EIGRP. The idea is the weighted static will be active, and when the client changes with VPN device to the new ASA, and the tunnel comes up, the ASA will create the static and it will redistribute and the Nexus will see it as a better weighted route and the new EIGRP route via the ASA will superseed the weighted static, and traffic will now flow over the new replacement ASA 5515x.
The problem is as soon as I create a LAN to LAN configuration on the ASA5515x (v8.6) with reverse-route-injection, the ASA creates the static route and it gets redistributed into EIGRP, killing the weighted static. If it does what it's supposed to do, the route for the LAN-to-LAN remote-network should NOT be created on the ASA until the tunnel actually comes up, but this is not what is happening. It is immediately creating a static. I've created just a dummy VPN config with a peer of 1.1.1.1 and remote-network of 2.2.2.2 with reverse-route injection, and as soon as I apply, a static gets created on the ASA and then redistributed to the Nexus 7k.
This has to be a bug right? We had 2900's that had the same problem using reverse route injection, but it was the routes not clearing after the tunnel dropped (the 2900 was terminating IPSEC tunnels for all clients on the local network), and I beleive it was resolved ( I wasn't directly involved in the case).
Regardless, what is happening is the static route is being created on the ASA unconditonally as soon as a VPN peer configuration is commited that uses reverse-route-injection. It should only be creating this static when the tunnel comes up, and it should remove the static when the tunnel drops.
Can someone at cisco confirm that this is a known issue on the ASA 5515X. I am going to put in a TAC case, but always like to get a discussion going with official feedback in forums as I myself use the forums as a resource to confirm behaviour I see before entering a TAC, and to validate behaviour based on other peoples real world issues.
